diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index a7a37c5..b480cdb 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -18,8 +18,8 @@ jobs:
       - run: go test -race ./...
       - name: Check Go version consistency
         run: |
-          mod_version="$(sed -nE 's/^go[[:space:]]+([0-9]+[.][0-9]+)([.][0-9]+)?([[:space:]]|$).*/\1/p' go.mod)"
-          docker_version="$(sed -nE 's|^FROM[[:space:]]+docker[.]io/library/golang:([0-9]+[.][0-9]+)([.][0-9]+)?-.*|\1|p' Dockerfile)"
+          mod_version="$(sed -nE 's/^go[[:space:]]+([0-9]+[.][0-9]+)([.][0-9]+)?([[:space:]]|$).*/\1\2/p' go.mod)"
+          docker_version="$(sed -nE 's|^FROM[[:space:]]+docker[.]io/library/golang:([0-9]+[.][0-9]+)([.][0-9]+)?-.*|\1\2|p' Dockerfile)"
           if [ -z "$mod_version" ]; then
             echo "::error::go.mod has no go directive"
             exit 1
diff --git a/Dockerfile b/Dockerfile
index 7331628..bbd6e4e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM docker.io/library/golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS builder
+FROM docker.io/library/golang:1.27.1-alpine@sha256:cf6fca6641884b8433441b2b0652976f975e1d0fdd26d177eaaf8596087f3125 AS builder
 ARG TARGETOS
 ARG TARGETARCH
 ARG VERSION
diff --git a/go.mod b/go.mod
index bf01c1a..22485b0 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/misospace/alert-triage
 
-go 1.27
+go 1.27.1
 
 // yaml.v3 is the sole non-stdlib dependency (see AGENTS.md). It is pinned at
 // v3.0.1; go.sum also carries its transitive test dep gopkg.in/check.v1 so the